                                                public-key
                                                extensions)]
     (write-cert-to-inventory! hostcert (:cert-inventory ca-settings))
-    (ks-file/atomic-write (:hostcert settings) (partial utils/cert->pem! hostcert) public-key-perms)
-    (ks-file/atomic-write (path-to-cert (:signeddir ca-settings) certname)
-                          (partial utils/cert->pem! hostcert)
-                          public-key-perms)))
+    (write-cert hostcert (:hostcert settings))
+    (write-cert hostcert (path-to-cert (:signeddir ca-settings) certname))))
 
 (schema/defn ^:always-validate initialize-master-ssl!
   "Given configuration settings, certname, and CA settings, ensure all

    {:not-before (.toDate not-before)
     :not-after  (.toDate not-after)}))

(schema/defn settings->cadir-paths
  "Trim down the CA settings to include only paths to files and directories.
  These paths are necessary during CA initialization for determining what needs

                                   (.getPublicKey (utils/pem->ca-cert cacert cakey))
                                   serial)
        new-full-chain (cons new-full-crl (vec rest-of-full-chain))]
    (write-crls new-full-chain cacrl)
    (log/debug (i18n/trs "Revoked {0} certificate with serial {1}" subject serial))

    ;; Publish infra-crl if an infra node is getting revoked.
